Constructing CSS Codes with LDPC Codes for the 
BB84 Quantum Key Distribution Protocol 
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Abstract — In this paper, we propose how to sunply 
construct a pair of linear codes for the BB84 quantum key 
distribution protocol. This protocol allows unconditional 
security in the presence of an eavesdropper, and the pair 
of Unear codes is used for error correction and privacy 
amplification. Since their high decoding performance im- 
pUes low eavesdropper's mutual information, good design 
of the two codes is required. The proposed method admits 
using arbitrary low-density parity-check (LDPC) codes. 
Therefore, it has low complexity and high performance for 
hardware implementation. Simulation results show that the 
pair of codes performs well against practical and various 
noise levels. 

Index Terms — Quantum cryptography, BB84 protocol, 
quantum key distribution, Calderbank-Shor-Steane codes, 
low-density parity-check codes. 

I. Introduction 

Public-key cryptosystems, based on some computa- 
tional assumption, such as RSA (TW\ are becoming 
weaker due to the progress of cryptanalysis and com- 
puting power, although long-term security has been 
demanded for diverse situations. In addition, if realistic 
quantum computers appeared, most current public-key 
cryptosystems would be broken |20]. 

On the other hand, a one-time pad offers information 
theoretic security. Due to random outputs that bear no 
statistical relationship to plaintexts, an adversary cannot 
obtain information about plaintexts from ciphertexts. A 
big problem with the one-time pad is that it requires 
to distribute truly random keys of the same length as 
plaintexts, at a rate of one per plaintext. 

One solution for the key distribution problem was 
suggested by Bennett and Brassard in 1984 IH. In 
the presence of an eavesdropper (Eve) with unlimited 
computational power, the BB84 quantum key distribution 
protocol allows unconditional security under the sole 



assumption that the laws of physics are correct lfT6l . |[2ll . 

In the BB84 protocol, a pair of classical binary linear 
codes, known as Calderbank-Shor-Steane (CSS) codes 
141 . is used for error correction and privacy amplification 
over a classical channel when a quantum channel is 
noisy. With the use of their decoding error probability. 
Eve's mutual information can be bounded. 

Quantum codes, applicable as CSS codes, have been 
studied previously by employing classical codes such 
as Hamming, BCH, and Reed-Solomon codes 131, ifTOl . 
These classic codes have plainly constructible dual ones 
for composing CSS codes, but their decoding perfor- 
mance is insufficient to be decodable against practical 
noise levels over the quantum channel. Consequently, 
it is necessary to design and evaluate the better pair 
of codes. In theoretical, after fixing one linear code, 
randomly choosing the other one is recognized as a good 
construction approach 1231 . However, a non-random and 
practical method for designing the proper pair of codes 
remains an open problem. 

Low-Density Parity-Check (LDPC) codes 121 are a 
class of error-correcting linear block codes admitting 
representations in terms of sparse bipartite graphs, 
known as Tanner graphs f2T\, with variable nodes and 
check nodes. LDPC codes provide near capacity per- 
formance on memoryless channels by the sum-product 
decoding algorithm. The purpose of this paper, therefore, 
is to construct the good pair of codes using LDPC codes. 

MacKay et al. have shown how to create the two 
codes by means of dual-containing LDPC codes ITSl . 
In the dual-containing LDPC codes, every pair of rows 
in their parity-check matrices must have an even overlap, 
and every row must have even weight. Because of these 
properties, the parity-check matrices have many cycles 
of length four in Tanner graphs. Since short cycles, 
particularly length four, in Tanner graphs have a bad 



influence on decoding performance by the sum-product 
algorithm, the technique presented in ifTSll cannot apply 
optimal LDPC codes. It is suitable for quantum error- 
correcting codes but not for the BB84 protocol. 

In this paper, we propose the simple and practical 
method for constructing the pair of codes admitting 
the use of arbitrary LDPC codes. For this reason, our 
proposal does not need high complexity for hardware 
implementation, and the pair of codes designed by the 
proposed method has the same decoding performance as 
chosen, namely, optimal LDPC codes. 

This paper is organized as follows. In Section JI] we 
introduce the BB84 quantum key distribution protocol. 
In Section JII] we describe efficiently encodable irregular 
LDPC codes. In Section JV] we propose how to construct 
the two codes using LDPC codes. In Section |V] we 
discuss the performance evaluation and show several 
simulation results for the proposed method. In Section 
IVTl we summarize the results. 

II. BB84 Quantum Key Distribution Protocol 

A. CSS Codes 

CSS codes invented by Calderbank, Shor, and Steane 
HI are a class of quantum error-correcting codes, and 
they are derived from classical linear codes by using the 
concept of dual codes. 

We first describe CSS codes. Let Ci and C2 be an 
[n, ki] and [n, classical linear code such that Ci D 
C2. With the use of Ci and C2, basis vectors for the CSS 
code, denoted as an [n,ki — ^2] quantum code, subspace 
can be represented as 

V — > —= \v + w), 
V\C2\ wee, 

where v G Ci. If the code C2 includes a codeword 
vi — V2, then the codewords corresponding to di and 
V2 are the same. Thus, these codewords are equivalent 
to cosets of C2 in Ci. The code Ci is used for bit-flip 
error correction, and the code is done for phase-flip 
one after the application of an Hadamard transform. 

B. Procedure of the BB84 Protocol 

In this subsection, for simplicity, we omit the proce- 
dure of the BB84 protocol over the quantum channel and 
introduce that over the classical channel. 

In the BB84 protocol, a sender (Alice) and a receiver 
(Bob) are participants. After communicating over the 
quantum channel and estimating a noise rate, Alice has 
an n bit string x, and Bob has an n bit string x + e. 
The procedure over the classical channel is as follows: 



1) Alice chooses a random n bit codeword S Ci. 

2) Alice announces x + u to Bob. 

3) Bob subtracts x-\-u from x + e and obtains u' by 
error-correcting the result, n + e, to the codeword 
in Ci. 

4) Alice obtains the coset of U + C2 as keys, and Bob 
obtains the coset of u' + C2 as keys. 

The code pair of Ci and C2 is CSS codes. In the 
BB84 protocol, it is used for error correction and privacy 
amplification. For correcting errors, it requires that the 
code Ci can be decodable by some practicable decoding 
algorithm. Even though AUce's codeword u is not equal 
to Bob's codeword u', provided that u' — u £ C2, Alice 
and Bob can share the same keys. Thus, for sharing the 
keys with high probability, the performance of the coset 
C1/C2 is important rather than that of the code Ci. 

C. Security Evaluation of the BB84 Protocol 

An entanglement purification protocol can bound 
Eve's mutual information on the shared keys |13|. If 
Alice and Bob share a fc-EPR-pair state with high fidelity 
F, where F > 1 — 5, then Eve's mutual information can 
be bounded by 

lEve < -(1 - (5) log2 (1 -6) -5 log2 ^2k _ l 

This inequality shows that high fidelity implies low 
entropy. By reduction from the entanglement purifi- 
cation protocol to the BB84 protocol via CSS codes 
llTl . the parameter 6 corresponds to the decoding error 
probability of the worse of the two codes Ci(Ci/C2) 
and C^(C^/Cj^). Hence, high decoding performance 
implies low Eve's mutual information, and the decoding 
error probability of the two codes must be small. In this 
paper, we analyze the block error probability. 

III. LDPC Codes 

Originally invented by Gallager in the early 1960's 
[9 1, LDPC codes have greatly developed as one of the 
most promising error-correcting codes in the last few 
years. They have been recently adopted as standard error- 
control coding techniques in several communication sys- 
tems. 

Every binary linear code of length n and dimension k 
can be represented as Tanner graphs with variable nodes 
Vi,0 < i < n — I and check nodes Cj,0 < j < k — 1. 
The following is an example for this representation: 

Example 3.1: Assume that the parity-check matrix H 
of LDPC codes of length n = 6 and dimension /c = 3 is 



given by 



H 



1 





The Tanner graph representing this LDPC code is shown 
in Fig. [Tj3 A cycle of length four can be seen in Fig. 
[T] that the set {v2,V3,co,ci} marked by bold lines. 
Short cycles in Tanner graphs degrade the decoding 
performance by the sum-product algorithm. 




Fig. 1. A Tanner graph 

LDPC codes are classified into regular LDPC codes 
and irregular ones. The decoding performance of irreg- 
ular LDPC codes is superior to that of regular ones, but 
irregular- LDPC codes usually need high complexity for 
their encoding processes. 

Irregular LDPC codes presented in fSl have algebraic 
structure and an efficient encoding algorithm. Besides, 
they perform well as compared to randomly constructed 
irregular LDPC codes. In this paper, therefore, we choose 
them as the code Ci. 

A. Efficiently Encodable Irregular LDPC Codes 

In this subsection, we introduce how to construct 
irregular LDPC codes proposed by Fujita et al. |8|. Let 
p be an odd prime number such that 2<j<k<p — I, 
and let H he a. parity-check matrix defined by an 
M(:= pj) X N{:= pj +pk) matrix [i^^^^ | H'^'^\ where 
the M X M submatrix and the M x {N - M) 

submatrix H^'^'^ are defined in block form as follows: 
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Fig. 2. Decoding performance of irregular LDPC codes of length 
almost 5000 and several rates on the BSC. 



where / is the pxp identity matrix, O is the pxp matrix 
of zeros; the pxp matrices P and T are defined by the 
following matrices: 



P :-- 





1 
1 



T 





1 1 
1 1 
1 



1 





1 














1 1 

1 



In addition, optimal irregular LDPC codes are con- 
structed by appropriately changing several block compo- 
nent of H^d) into the pxp matrix O (called a masking 
method [5|). 

Fig. |2] depicts the performance result of almost length 
5000 and rate 0.82, 3/4, 2/3, and 0.55 by sum-product 
decoding with up to 100 iterations on a binary symmetric 
channel (BSC). In all cases, we employed p = 73 as 
the prime number, and their LDPC codes were designed 
based on masking matrices given in App. [A] Despite 
the negligible area of probability for error correction, 
the LDPC codes of rate 3/4 and 2/3 have an error floor 
starting at the block error probability of lO""^ as com- 
pared to those of rate 0.82 and 0.55 due to column wight 
three in their party-check matrices. However, due to little 
information about the detailed methods for constructing 



optimal masking matrices, we note that their elaborate 
design can further improve their performance. 

IV. Design of CSS Codes 

In this section, we propose how to construct the pair 
of codes using LDPC codes, the method is executed by 
the following procedure: 

1) Choose arbitrary LDPC codes defined by an M x 
A'^ parity-check matrix Hi for the code Ci. 

2) Separate an M x {N - M) matrix H[ from Hi 
in ascending order of column weights, encode bits 
of length N — M, where these bits are the row 
vectors of H[, to codewords in Ci, and generate 
the M X N parity-check matrix H2 by the set of 
the codewords of Ci. 

3) Defined the code by H2. 

The parity-check matrix H2 is composed of codewords 
in Ci, we have H1H2 = O, hence the two codes satisfy 
the CSS code condition Ci D C2. 

This method can apply arbitrary LDPC codes and 
simply construct the two codes by only choosing the 
code Ci. By using pseudo-random property of LDPC 
codes, it pseudo-randomly creates the code C2. In short, 
the proposed method is a practical approach of the 
random construction presented in |[23l . 

The parity-check matrix H2 has a low-density subma- 
trix and a high-density submatrix. As for theoretical de- 
coding performance, since linear codes defined by high- 
density parity-check matrices have better performance 
than those by low-density ones 1 19|, it can be anticipated 
that the code C2~ has a superior decoding property. 

Suppose that the rate of Ci is r, the rate of is also 
r, so the rate as CSS codes designed by this method is 
2r - 1. 

V. Simulation Results 

In this section, we show the simulation results for the 
pair of linear codes constructed by the propose method 
on the BSC. We can consider errors between Alice and 
Bob as ones over the BSC. First of all, we discuss 
how to evaluate the decoding performance of the code 

A. Decoding Performance Analysis of the Code 

The code Ci is LDPC codes; therefore, its perfor- 
mance can be simply evaluated by sum-product decod- 
ing. Since the code does not directly correct errors 
in the BB84 protocol, it is sufficient to analyze the 
performance by some robust and specifically evaluable 
decoding algorithm. 
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Fig. 3. Decoding performance of the two codes constructed by 
(3,15) near regular LDPC codes of length 480 and rate 0.8; the rate 
as CSS codes is 0.6. 



While maximum likelihood decoding (MLD) is a 
powerful algorithm, we cannot evaluate the performance 
of C2{C2/Ci ) due to its decoding complexity. More- 
over, we cannot analyze the performance by the general 
sum-product decoding algorithm as well because of a 
high-density part of H2. Owing to the difficulty of the 
decoding performance evaluation, both codes tend to be 
constructed as mediocre LDPC codes and evaluated by 
sum-product decoding im, dl, ifBl . 

As a robust decoding algorithm having close per- 
formance to MLD, Fossorier et al. have proposed to 
combine sum-product decoding with ordered statistic 
decoding (OSD) [7|. In the present paper, instead of 
general sum-product decoding, we applied bit serial 
sum-product decoding [24J, which is the basically same 
algorithm as shuffled belief propagation decoding |[26l . 
and we remove cycles of length four lfT2l . |[25l for 
solving short cycles in Tanner graphs prior to decoding. 
Bit serial sum-product decoding [24] is the improved 
algorithm, operating the propagation of likelihood in- 
formation in Tanner graphs bit-by-bit, of general sum- 
product decoding, and the algorithm in lfT2l . ||25l can 
remove cycles of length four by transforming Tanner 
graphs under the code-equivalent condition. 

In the first example, we constructed the two codes 
by (3,15) near regular LDPC codes of length 480 and 
rate 0.8. The rate as CSS codes is 0.6. Fig. [3] depicts 
the performance result for Ci decoded by the gen- 
eral sum-product algorithm, C-^iC-^/Ci-) done by the 
original combined algorithm and by the modified one. 
In both cases of the original combined algorithm and 



the modified one, the algorithm of the removal of the 
cycles of length four is applied prior to sum-product 
decoding. We chose the maximum numbers of iterations 
of Ci and C^{C^/C^) to be 100 and 256, respectively. 
The parameter of the OSD algorithm is set to order-2 
reprocessing. In all Figs, henceforth, we note that 
represents a dual code C^. 

In comparing the original combined algorithm and the 
modified one, a dramatic improvement with respect to 
the decoding performance is realized by our modified 
approach. The decoding performance of / by the 
modified algorithm after the transformation of the Tanner 
graph is superior to that of the LDPC code Ci by sum- 
product decoding. 

B. Approximative Decoding Approach 

The modified algorithm has a disadvantage that de- 
coding complexity is too high to decode LDPC codes 
with block lengths of more than a few thousand bits. 
Therefore, we suggest and apply an approximative eval- 
uation algorithm. For explaining the algorithm, we give 
one theorem: 

Theorem 5.1: On a binary erasure channel (BEC), 
sum-product decoding is equal to MLD after the trans- 
formation of Tanner graphs (or parity-check matrices) in 
response to erasure bits. 

Proof: When the sum-product decoding algorithm 
fails on the BEC, a set of erasures is equal to the unique 
maximum stopping set [6|. The stopping set S is the 
subset of the set of variable nodes in the Tanner graph, 
and all neighbors in S are connected to S at least twice. 
After the weights of the columns having an erasure bit 
are transformed to one, namely, the number of the con- 
nections is one, erasure bits can be decoded by the sum- 
product algorithm. If they cannot be transformed, the 
stopping set is a valid codeword. Erasure bits consisting 
of S containing valid codewords cannot be decoded even 
though we exploit MLD. Hence, sum-product decoding 
is equal to MLD after the transformation of the Tanner 
graphs in response to erasure bits. ■ 
High-density parity-check matrices have many small 
stopping sets due to many cycles, but transforming their 
Tanner graphs can remove small stopping sets as well as 
short cycles. 

1 ) Decoding Process: On the basis of Theorem 15.11 
we evaluate the performance of (^^(C^/Cj*") on the 
BSC, and the detailed procedure is performed as follows: 
a) Transform the number of the edges of the nodes 
having an error in the Tanner graph to less than 
three. 



b) Remove cycles of length four in the Tanner graph. 

c) Decode received words to codewords by the gen- 
eral sum-product algorithm. 

We anticipate some objections to this methodology, but 
in our computational simulations, decoding results have 
no failures when less than a few errors occur in the high- 
density part of parity-check matrices. To put it more 
precisely, received words are decoded to codewords in 
C2 /Ci, or they cannot be estimated to any codewords. 
In all cases that more than a few errors occur in the 
high-density part of parity-check matrices, no codewords 
can be estimated due to many cycles in Tanner graphs. 
For these reasons, only errors in the low-density part of 
parity-check matrices is important for the evaluation of 
C^(C^/Cj^), and it is reasonable to suppose that this 
evaluation algorithm are near optimal on the BSC. 

2) Generalized Decoding Process: If we generalize 
the methodology, then the decoding process is illustrated 
as follows: 

a) Prepare a number of different parity-check matri- 
ces, composed of a low-density submatrix and a 
high-density submatrix, in the same code. 

b) Remove cycles of length four in each Tanner 
graph. 

c) Decode received words to codewords by sum- 
product algorithm using each parity-check matrix. 

d) Estimate codewords by a majority decoding result. 
In practical, since we cannot prepare numerous parity- 
check matrices, we assume that the code is decoded 
by this generalized decoding process and, as mentioned 
in Sub-subsection I V-B 1 [ evaluate the performance by 
transforming the Tanner graph in response to error bits 
with one matrix. 

C. Decoding Performance of Moderate-Length Codes 

In this subsection, we show simulation results for 
moderate-length codes. As the way for the performance 
evaluation of C^(C^/Cj'-), we applied the above ap- 
proach. 

Figs. |4] and [5] depict the simulation results for the two 
codes by irregular LDPC codes in [8] of length 2183 
and rate 0.78; length 7832 and rate 0.55, respectively. We 
employed 59 and 89 as the prime number p. Their LDPC 
codes were designed based on masking matrices given 
in App. |B] In both cases, the decoding performance of 
02(02 /C^) is superior to that of the LDPC code Ci. 
Table U summarizes the relationship between the noise 
and the results covered in / O^ in Fig. |5] We see from 
TableUthat the coset O2 /Oi covers the most codewords 
that are decoding failures in C^. This is attributed to 
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Fig. 4. Decoding performance of the two codes constructed by 
irregular LDPC codes of length almost 2000 and rate 0.78; the rate 
as CSS codes is 0.56. The maximum number of iterations was set to 
100 and 256, respectively. 
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Fig. 5. Decoding performance of the two codes constructed by 
irregular LDPC codes of length almost 8000 and rate 0.55; the rate 
as CSS codes is 0.1. The maximum number of iterations was set to 
200 and 512, respectively. 



TABLE I 

Success rate covered in /Ct shown in Fig. [5] 



Noise rate on BSC (%) 


Success rate covered in C2" / Ci' (%) 


8.0 


85.8 


7.75 


82.4 


7.5 


75.8 


7.25 


67.5 


7.0 


61.1 


6.75 


52.4 



many small codewords in Cj*-, and it results from small 
row weights in Hi of low-rate LDPC codes. 

Since the code C2{C2~/Cj-) has better performance 



than the LDPC code Ci in every experimental result, the 
proposed method can bound Eve's mutual information on 
keys by the performance of the LDPC code Ci. As for 
Eve's mutual information on the generated 712 bit key 
in Fig. [5j for example, they can be bounded by Ievc < 
0.5936 with the crossover probability 6.5% on the BSC 
and Ievc < 6.312 with the crossover probability 6.75%. 

If we choose LDPC codes of almost length 10000 and 
a little higher rate than 0.5 as the code Ci, then it can 
be expected that the two codes are decodable with the 
crossover probability approximately 8.5% on the BSC, 
keeping Eve's mutual information small. 

VI. Conclusion 

In this paper, we introduced the simple method for 
constructing the good pair of codes using LDPC codes. 
First by the combined algorithm of robust decoding 
and the transformation of Tanner graphs, second by the 
approximative decoding approach for moderate-length 
codes, we evaluated the performance. Since the pro- 
posed method admits to apply arbitrary LDPC codes, 
it is less complex and better performance than existing 
methods. The simulation results indicate that the two 
codes constructed in this paper can be decodable against 
practical noise levels on the quantum channel and bound 
Eve's mutual information on keys by the performance 
of chosen LDPC codes. Therefore, this method allows 
secure and effective key generations. 

Appendix A 

Masking matrices Wrate used in simulations are as 
follows: 

■10000010000000001000100100001001000010001100110101101111 
10100000010000010001000000100011000100100011101011110110 
00000100100010000001001000100100010010001110110101011011 
01000100110000010000100000110001000100100011011010101001 
10010000100010010001000100010000000100010100101111010110 
01010010000010001000110001000100010001000111010000111011 
00000101010100100010000101001000001000001001010111010101 
00100001000101001100010010010000010001100110001010101110 
00001000001001100000001001000010101000010011100111101101 
01000010001001000110010000001000100010000100111001111010 
00011000000100000010000010000110001000010011111110010111 

•001010010010001001000010100000001000010001010011 11 111 101. 

000001000000100001000001000010101011010110101011011 
000000000100001001010000010000110101101011010101101 
100000100001000000100100000001101011010011101010110 
100001000010000100000100000000101101010110011101011 
000000100000100000010000100101011010110101101010110 
000010000010000010000001010000101101011100101101011 
010100010001000000000000100001011010110101011010110 
001000001000010000010000001011010110101101010110010 
000100000100000010000100001000110101101010110101101 
100000100000010001000010000001101010110101101011010 
000010000100000100000010000010110101011010110101101 
010000010000010000100001000001011010101101011010110 
000010000010001000001000001000101101011010110101101 
001000001000001000100000100001010110101011010110101 
000100001000000100001000000101010101101011100111010 
001000010000100000001000010001010110101101011010101 
.010001000001000010000010000101101011010110101101001. 

0000000100000010100000000000010101001010100101 
0000100001000101000000000000101001010101001010 
0000000010000000100000000101010010101010010101 
0100000000000010000001000010101010010101001010 
0000010000100100000000000101010001101001010100 
0000000100000000010000000011010100101010100101 
0010000001000000001000000100101010010101001010 
1000000010000000010000000001010100101010010101 
0001000000100000000100001000101001010100101010 
0000000000010000001000100011001010100101010100 
0000000001000000000100011000010100101001010101 
1001001000001000000000000000101001010100101010 
0100000000010000000000000001110010100101010010 
0000000000001000001000001000101010010011010001 
0000100000010000000010000001000101001100101010 
0000010000001000000100000000101001010101010001 
0010001000000000010010000001000110100010101010 
0000010000000001000001010000100101010010101001 
0100000100000100000000100001001010101001010100 
0010101000000000000000010000010101010010100110 
0001000000100000100000100000010110001100101001 
1000000000000010000001000000101011010010101010 
.0000000010000001000010000001010100101010010101 



Wo. 82 = 



"2/3 ' 



00000100001000000000000010000101000001 
00001000000100000010100000100010000000 
00000000100000000101000000001000101000 
00001000000010001000000100000000010010 
10000000010000000000011000010000000100 
00100010000001000000000000001000001010 
00100100000010000000100000100010000000 
00010000000101000000000000000101001000 
00000010000000001001010000000000010010 
10001000010000000010000001000100000000 
01000000000100000000100100010001000000 
00000000101000010000000010000010000001 
00100000000010001000001000000000101000 
00001000000001010000000000010100010000 
00010000000100000000010000101000000001 
00000001100000100100000100000001000000 
10000010001000000001001000000010000000 
01000100010000000010000000100000000100 
01000000000000100100000010010010000000 
10000000100000010000100000000100100000 
00000100000001001001000001000000010000 
00000011010010000000000010000000100000 
00010000001000010010010000001000000010 
00100001000000000000001001000001001000 
01000000001000000000010100000000100100 
00010000010000001000001000100000010000 
00100000100100100000100001000000000100 
00010001000000100101000000001000000001 
00001000000010010000000100010000000010 
10000010000001000100000010000000000100 
LOIOOOIOIOOOOOOIOOOIOOOOOOIOOOOOOOOOOOI 



Appendix B 

Masking matrices Wrate used in simulations are as 
follows: 



oooioioioiioooiiioioiioiioior 

00100100110111111011010010110 
10001010010100110111011011110 
W - 01100010011010011101101101001 
I'i'o.s - 10011001001111101000101011110 
01001010001101010111110101101 
01010001110111000111011100011 
.10100100101011101100101111011. 



001000001000000000000000010000000000100000000010 
000100000000000000000000000000100010010001000001 
010010000000000001001100000000000001000000000000 
100000100100000000000001000001000000000000000100 
000000000010010000010000000010000000000000110000 
000000010000100010100010000000010000000000000000 
000000000000001 100000000001000001 100000010000000 
000001000001000000000000100100000000001000001000 
000100100000000000000001000000101001000000000000 
000000000010000001000000000000010000011010000000 
000010000000001000100010010000000000000000100000 
000000010000010000000100001100000000000100000000 
000000000001000010000000000000000110000000010100 
000000000000100000010000100000000000100001000001 
101000000000000100001000000001000000000000001000 
010001001100000000000000000010000000000000000010 
000010000000000010000000010001000010000000000010 
000000000000000100001000000000000000011010000001 
101100010000010001000000000000000000000000000000 
000000100000000000000000000010001100000001010000 
000001000010100000010000100000100000000000000000 
010000000101000000000001000000010000000000100000 
000000000000001000100010000100000000100000000100 
000000001000000000000100001000000001000100001000 
000100100000000000001000010001000100000000000000 
010000000000010000000000100000000010001000000010 
001001000011000000000001000100000000000000000000 
000000000000001000000100000000111000000000001000 
000010000000000010110000000010000000000010000000 
000000001000100000000000001000000000000001100001 
000000000100000001000010000000000000110100000000 
100000010000000100000000000000000001000000010100 
000000010001000100000000000001000001000000100000 
010000101000000000000000000000100100000000001000 
000010000000000010000000001000001000001010000000 
001000000000000000100010000000000000100000010010 
100000000100000000001001010000010000000000000000 
000000000000111000000000000000000000010001000001 
000100000010000000010100000000000010000100000000 
.000001000000000001000000100110000000000100000100 

Almost all matrices in App. |A] and |B] were designed 
based on degree distribution pairs given in [U. 



Wo.55 = 
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